{"schemaVersion":3,"id":"CVE-2008-0948","aliases":["DEBIAN-CVE-2008-0948"],"status":"published","duplicateOf":null,"title":null,"description":"Buffer overflow in the RPC library (lib/rpc/rpc_dtablesize.c) used by libgssrpc and kadmind in MIT Kerberos 5 (krb5) 1.2.2, and probably other versions before 1.3, when running on systems whose unistd.h does not define the FD_SETSIZE macro, allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code by triggering a large number of open file descriptors.","dates":{"published":"2008-03-19T00:00:00.000Z","modified":"2024-08-07T08:01:40.108Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":9.3,"severity":"high","version":"2.0","versionLabel":"v2.0","source":"NVD","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","computed":false,"selection":"backend-summary"},"metrics":[{"version":"2.0","versionLabel":"v2.0","source":"NVD","score":9.3,"severity":"high","vector":"AV:N/AC:M/Au:N/C:C/I:C/A:C","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.07273,"percentile":0.94298,"severity":"low","asOf":"2026-10-19T00:00:00.000Z","change":{"pp":0,"baselineDate":"2026-09-19T00:00:00.000Z","baselineScore":0.07273},"history":[{"date":"2026-09-14T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-15T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-16T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-17T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-18T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-19T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.07273,"percentile":0.94298}],"last30":[{"date":"2026-09-19T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-20T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-21T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-22T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-23T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-24T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-25T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-26T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-27T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-28T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-29T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-09-30T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-01T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-02T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-03T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-04T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-05T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-06T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-07T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.07273,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.07273,"percentile":0.94298}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[{"id":"CWE-119","name":"Improper Restriction of Operations within the Bounds of a Memory Buffer","description":"The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.","type":"weakness","status":"Stable","abstraction":"Class","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/119.html"}],"affected":[{"vendor":"debian","product":"krb5","name":"krb5","label":"krb5","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/krb5","purlType":"deb","versions":[{"text":"< 1.3-1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.3-1","eol":null,"hubHref":null},{"vendor":"mit","product":"kerberos_5","name":"kerberos 5","label":"kerberos_5","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"1.2.2","noFixRecorded":false,"fixedIn":null}],"versionsText":"1.2.2","eol":null,"hubHref":"/vendor/mit/kerberos_5"}],"affectedCount":2,"eol":{"hasEol":false,"count":0},"references":[{"url":"http://securityreason.com/securityalert/3752","label":"securityreason.com/securityalert/3752","hostname":"securityreason.com","tags":["Third Party Advisory","X Refsource SREASON"]},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9209","label":"oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9209","hostname":"oval.cisecurity.org","tags":["VDB Entry","Signature","X Refsource OVAL"]},{"url":"http://www.us-cert.gov/cas/techalerts/TA08-079B.html","label":"www.us-cert.gov/cas/techalerts/TA08-079B.html","hostname":"www.us-cert.gov","tags":["Third Party Advisory","X Refsource CERT","US Government Resource"]},{"url":"http://www.vupen.com/english/advisories/2008/1744","label":"www.vupen.com/english/advisories/2008/1744","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.securityfocus.com/archive/1/489784/100/0/threaded","label":"www.securityfocus.com/archive/1/489784/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://www.securityfocus.com/bid/28302","label":"www.securityfocus.com/bid/28302","hostname":"www.securityfocus.com","tags":["VDB Entry","X Refsource BID"]},{"url":"http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022542.html","label":"support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022542.html","hostname":"support.novell.com","tags":["X Refsource CONFIRM"]},{"url":"http://marc.info/?l=bugtraq&m=130497213107107&w=2","label":"marc.info?l=bugtraq&m=130497213107107&w=2","hostname":"marc.info","tags":["Vendor Advisory","X Refsource HP"]},{"url":"http://secunia.com/advisories/29663","label":"secunia.com/advisories/29663","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vmware.com/security/advisories/VMSA-2008-0009.html","label":"www.vmware.com/security/advisories/VMSA-2008-0009.html","hostname":"www.vmware.com","tags":["X Refsource CONFIRM"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/41274","label":"exchange.xforce.ibmcloud.com/vulnerabilities/41274","hostname":"exchange.xforce.ibmcloud.com","tags":["VDB Entry","X Refsource XF"]},{"url":"http://www.vupen.com/english/advisories/2008/0922/references","label":"www.vupen.com/english/advisories/2008/0922/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://secunia.com/advisories/29428","label":"secunia.com/advisories/29428","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA","Vendor Advisory"]},{"url":"http://secunia.com/advisories/30535","label":"secunia.com/advisories/30535","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.securityfocus.com/archive/1/489762/100/0/threaded","label":"www.securityfocus.com/archive/1/489762/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022520.html","label":"support.novell.com/docs/Readmes/InfoDocument/patchbuilder/readme_5022520.html","hostname":"support.novell.com","tags":["X Refsource CONFIRM"]},{"url":"http://www.securityfocus.com/archive/1/493080/100/0/threaded","label":"www.securityfocus.com/archive/1/493080/100/0/threaded","hostname":"www.securityfocus.com","tags":["Mailing List","X Refsource BUGTRAQ"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html","label":"lists.opensuse.org/opensuse-security-announce/2008-03/msg00006.html","hostname":"lists.opensuse.org","tags":["Vendor Advisory","X Refsource SUSE"]},{"url":"http://web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-002.txt","label":"web.mit.edu/kerberos/advisories/MITKRB5-SA-2008-002.txt","hostname":"web.mit.edu","tags":["X Refsource CONFIRM"]},{"url":"http://secunia.com/advisories/29424","label":"secunia.com/advisories/29424","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.redhat.com/support/errata/RHSA-2008-0181.html","label":"www.redhat.com/support/errata/RHSA-2008-0181.html","hostname":"www.redhat.com","tags":["Vendor Advisory","X Refsource REDHAT"]},{"url":"http://www.securitytracker.com/id?1019631","label":"www.securitytracker.com/id?1019631","hostname":"www.securitytracker.com","tags":["VDB Entry","X Refsource SECTRACK"]},{"url":"http://secunia.com/advisories/29423","label":"secunia.com/advisories/29423","hostname":"secunia.com","tags":["Third Party Advisory","X Refsource SECUNIA"]},{"url":"http://www.vupen.com/english/advisories/2008/1102/references","label":"www.vupen.com/english/advisories/2008/1102/references","hostname":"www.vupen.com","tags":["VDB Entry","X Refsource VUPEN"]},{"url":"http://www.kb.cert.org/vuls/id/374121","label":"www.kb.cert.org/vuls/id/374121","hostname":"www.kb.cert.org","tags":["Third Party Advisory","X Refsource CERT VN","US Government Resource"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2008-0948","label":"security-tracker.debian.org/tracker/CVE-2008-0948","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":["RHSA-2008:0181"],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2008-03-19T00:00:00.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2024-08-07T08:01:40.108Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":70,"level":"high","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-20T09:12:49.149Z","stale":false,"partial":false}}